BitBox and Trezor customers hit by fake vulnerability alerts after Brevo email provider breach

BitBox and Trezor customers received fake entropy vulnerability alerts on 9 September sent from the companies' real domains, with SPF and DKIM checks passing; neither firm was breached, but their shared email vendor Brevo was. BitBox had confirmed phishing emails were being sent to its newsletter subscribers from the bitbox.swiss domain after the Brevo compromise.

Detected & updated continuously · Source: Nebula